Malicious code in stellarfixer (npm)

The npm package stellarfixer was found to contain malicious code distributed via a postinstall script that unconditionally executes a bundled Windows PE binary (bin/stellarfn.exe) on package installation.\n\nThe binary is a .NET remote-access trojan with extensive malicious capabilities: it establishes a socket-based command-and-control channel with plugin loading support, installs a system-wide keyboard hook to capture credentials from all active windows, captures webcam frames, and includes mechanisms to propagate to removable USB drives. The trojan also implements anti-analysis and anti-removal features including antivirus exclusions and process-critical flags.\n\nInstallation of this package on a Windows host results in immediate full system compromise, remote attacker control, credential theft, and potential worm-like propagation via USB media. The incident was identified and credited to the OpenSSF malicious packages project.